Hive Authorization and Authentication Models

This assignment delves into the security mechanisms of Apache Hive, focusing on both authorization and authentication models. It explains different authorization models like Hive Default Authorization, Storage Based Authorization (SBA), and SQL Standard Based Authorization, highlighting their functionalities and limitations. The assignment also explores various authentication methods supported by Hive components like HiveServer2, WebHCat, and MapR cluster, emphasizing the importance of secure configurations for robust system security.

Running head: OPTIONS AVAILABLE FOR AUTHORIZATION AND AUTHENTICATION
IN HIVE 1
Options available for authorization and authentication in Hive
Name
Institution
Professor
Course
Date

OPTIONS AVAILABLE FOR AUTHORIZATION AND AUTHENTICATION IN HIVE 2
Introduction
Hive authorization and authentication are two different terms that are used to give access
to the Hive. In a Hive security measures, system are designed to provide security screening
before a user can be allowed into the system. System authentication is used to provide
verification identity of all users. It determines if users logged into the system are real ones or not
(Bansal, 2016). Similarly, authorization is used to ascertain whether user trying to access the
system have required privileges to perform some actions. After logging into the system, user
responsibilities are categorized according to roles they play in the organization and their areas of
expertise. It is through authorization where some users are given capability to enter data into the
system but they cannot alter or delete while others are able to just view without any further
action. Due to roles and responsibilities assigned to various users, these two security measures
provide various options to manipulate the system.
Hive Authorization models
After user logs into the system, Hive grants permission in various categories namely;
Hive Default Authorization which does not provide required complete access model of the
system and leaves many security gaps which has to be addressed in order to protect data (Du,
2015). In this case, users are able to grant or revoke themselves permission from the system. In
Hive operations to grant permission to either groups, users and roles, if user privileges which
determines if privileges has been granted, groups privileges checks whether user is part of the
group already granted permission and Roles privileges which checks on roles granted to
privileges (Shaw et al, 2016). Next, in Storage Based Authorization (SBA) at Metastore, Hive
makes use of HDFS permissions provided at folder level in relation to metadata objects which
serves as authorization policy source of truth. By enabling SBA in metastore, when a given user

OPTIONS AVAILABLE FOR AUTHORIZATION AND AUTHENTICATION IN HIVE 3
tries to gain access to the any content, it has to check whether user has been granted permission.
Finally, Hive makes use of SQL Standard Based Authorization which makes Hive to comply
fully with SQL rules (Dinsmore, 2016). It has to be used according to the rules of metastore
server authorization. Client has to use either SQL or ODBC through HiveServer2 then required
access can be granted.
Hive authentication models
Determining who has been logged into the system is of great importance and system has
different mechanisms to determine who has accessed the system. According to Spivey &
Echeverria (2015), methods used to configure either Hive Metastore, WebHcat or HiveServer2 is
the main determinant of how various Hive components can make access and connect to each
other. Any client who makes use of these authentication model should have additional
configurations and other dedicated connection strings in regard to which authentication method
has been chosen (Capriolo, Wampler & Rutherglen, 2012). In order to make use of Hive
authentication, it is important to evaluate authentication measures which are supported by certain
component and client, perform Hive configuration components and their related clients and
determine how each of the subject client may connect to each of the Hive component.
Additionally, in HiveServer2Authentication support; MapR cluster, Hive Metastore
Authentication and HiveServer2 Authentication options has to be configured in order to provide
system users with require access to the system (Narayanan, 2013). In HiveServer2
Authentication Support, MapR cluster is considered because it is regarded as secure one to use in
all the two cases, Hive Metastore in remote authentication and HiveServer2 authentication
options. Similarly, Sarkar (2014) argues that, most of Hive Metastore which is remote
authentication are still not secure with an exception of Keberos and MapR-SASL. In case of

OPTIONS AVAILABLE FOR AUTHORIZATION AND AUTHENTICATION IN HIVE 4
WebHCat authentication Support, MapR cluster is also considered secure in all cases of Hive
Metastore remote Authentication and WebHcat authentication.
Conclusion
In both authorization and authentication models, it is possible to pin point how Hive
security is provided to the system and methods which are available in each scenario. To make
system secure, several criteria has to be met in order to make sure required access privileges are
granted to respective users. It is important to meet all requirements of system authorization and
authentication in order to make sure security of the system is guaranteed and at the same time,
right users access is granted.
References
Bansal, H. (2016). Apache Hive Cookbook. Packt Publishing.
Capriolo, E., Wampler, D., & Rutherglen, J. (2012). Programming Hive. Sebastopol, CA:
O'Reilly & Associates.
Du, D. (2015). Apache Hive Essentials. Packt Publishing.
Narayanan, S. (2013). Securing Hadoop. Packt Publishing.
Sarkar, D. (2014). Pro Microsoft HDInsight: Hadoop on Windows.
Shaw, S., Vermeulen, A. F., Gupta, A., & Kjerrumgaard, D. (2016). Practical Hive: A guide to
Hadoop's data warehouse system.
Spivey, B., & Echeverria, J. (2015). Hadoop security: Protecting your big data platform.

OPTIONS AVAILABLE FOR AUTHORIZATION AND AUTHENTICATION IN HIVE 5
Dinsmore, T. W. (2016). Disruptive analytics: Charting your strategy for next-generation
business analytics.